EUVD-2026-55219

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...

CVE-2026-72691 OpenSignLabs opensignserver - Authentication Bypass

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...

CVE-2026-72587

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...

CVE-2026-72587 Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Added a call to putpid. Added a call to putpid corresponding to gettaskpid. host1xmemorycontextalloc does not take ownership of the PID, so we need to free it here to avoid leaks. [email protected]: reword commit...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP – Fixed issue where multiple L2CAPECREDCONNREQUESTs were accepted. Currently, the code attempts to accept requests regardless of the command identifier. This can result in multiple requests being marked as pendin...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: drm/amdkfd: Fixed the bounds checking of watchid in debug address watch v2. The address watch clear code receives watchid as an unsigned value u32, but some helper functions used a signed int and checked the bits by shifting...

EUVD-2026-54999

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...

CVE-2026-17022

The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplyi...

CVE-2026-19053

The CVE-2026-19053 entry concerns the ProSolution WP Client WordPress plugin prior to version 2.0.6. The vulnerability arises from unsanitized/untouched input used directly in a SQL statement in a parameter reachable by unauthenticated visitors, causing a blind SQL injection. Affected product: Pr...

EUVD-2026-55016

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...

CVE-2026-15238

The CVE concerns the MotoPress Hotel Booking WordPress plugin prior to version 6.2.3. It lacks ownership verification when updating customer records, enabling any authenticated user with a low-privilege role (Subscriber and above) to modify or overwrite personal data of any customer by supplying ...

CVE-2026-19381

creationtimestamp| type| source ---|---|--- 2026-08-10 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/117068623277375334 2026-08-10 01:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msoxaf46yl2v 2026-08-10 02:00:02+00:00| seen|...

MINI-J4WQ-CP5R-CCW7

Bulletin has no description...

MINI-XQ7F-G2C6-95HC

Bulletin has no description...

JS Help Desk <= 2.8.1 - SQL Injection

The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to SQL Injection via the 'email' and 'trackingid' parameters in all versions up to 2.8.2 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

Hikvision IP ping.php - Command Execution

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.320201113RELEASEHIK. It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondataip with the input netstat -ano leads to os command injection...

CVE-2026-56793

creationtimestamp| type| source ---|---|--- 2026-08-09 15:04:41+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117066162544319010 2026-08-09 15:04:41+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msnubd3w252d...

CVE-2026-70628

creationtimestamp| type| source ---|---|--- 2026-08-09 14:02:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnqoqqo7y27...

EUVD-2026-54914

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument taskid/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public...